Privacy Policy

1. Introduction

Yalla CRM, a product of Yalla Technologies LLC ("we," "our," "us," or the "Company"), is a customer relationship management platform organized under the laws of the State of Wyoming, United States. We are committed to protecting your privacy and handling your personal data in compliance with applicable United States federal and state privacy laws, including the California Consumer Privacy Act (as amended by the CPRA) where applicable, and other applicable data protection regulations.

This Privacy Policy explains how we collect, use, process, store, share, and protect your personal data when you use our WhatsApp Business Management Platform, mobile applications, and related services (collectively, the "Services"). By using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Definitions

For the purposes of this Privacy Policy:

• "Personal Data" means any data relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, online identifier, or factors specific to the physical, psychological, economic, cultural, or social identity of that person.
• "Sensitive Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation.
• "Processing" means any operation performed on personal data, whether automated or not, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
• "Data Subject" means the individual to whom the personal data relates.
• "Controller" means the entity that determines the purposes and means of processing personal data.
• "Processor" means the entity that processes personal data on behalf of the Controller.

3. Data Controller

Yalla CRM acts as the Data Controller for the personal data we collect directly from you. When you use our Services to manage your customer relationships, you act as the Data Controller for your customers' data, and Yalla CRM acts as the Data Processor on your behalf.

4. Legal Basis for Processing

In accordance with applicable U.S. privacy laws and international data protection standards, we process your personal data based on one or more of the following legal grounds:

• Consent: You have given explicit consent for processing your personal data for specific purposes.
• Contractual Necessity: Processing is necessary for the performance of a contract to which you are a party, or to take pre-contractual steps at your request.
• Legal Obligation: Processing is necessary for compliance with applicable laws and regulations to which we are subject.
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms.
• Vital Interests: Processing is necessary to protect the vital interests of you or another natural person.
• Public Interest: Processing is necessary for the performance of a task carried out in the public interest.

5. Personal Data We Collect

6. Sensitive Personal Data

We do not intentionally collect sensitive personal data as defined under applicable U.S. privacy laws. Our Services are designed for business communications and customer relationship management, and we request that you do not submit sensitive personal data through our platform.

If you are a business user processing your customers' data through our platform, you are responsible for ensuring compliance with applicable laws regarding sensitive personal data. You must obtain explicit consent before processing any sensitive personal data and implement appropriate safeguards.

7. How We Use Your Personal Data

We process your personal data for the following purposes:

8. Disclosure of Personal Data

We may share your personal data with the following categories of recipients:

We do not sell your personal data to third parties for their marketing purposes.

9. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside the United States where our service providers operate. These countries may have different data protection laws than those of the United States.

When we transfer personal data internationally, we implement appropriate safeguards in compliance with applicable U.S. privacy laws, including:

• Standard Contractual Clauses approved by relevant data protection authorities
• Data processing agreements with adequate security provisions
• Ensuring the recipient country provides adequate data protection or the transfer falls under permitted exceptions
• Obtaining your explicit consent where required

10. Data Security

We use technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. They include:

• Encryption in transit: data sent to and from our Services is encrypted with TLS
• Encrypted credentials: access tokens for accounts you connect, such as email and social accounts, are encrypted at rest
• Customer isolation: each customer's data is kept separate from every other customer's at the database level
• Access control: role-based permissions inside Yalla CRM, and access to production systems limited to staff who need it
• Incident response: we investigate suspected security incidents and notify affected customers and authorities where the law requires
• Hosting providers: our data is hosted with established providers (listed in section 8.1) whose data centres have their own physical and environmental security controls
• Encryption at rest: our database provider encrypts stored data at rest

Despite our efforts, no security measures are completely impenetrable. We cannot guarantee absolute security of your data transmitted to our Services.

11. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Active Account Data: Retained for the duration of your subscription and account activity
• Transaction Records: Retained as required by applicable U.S. federal and state law
• Communication Records: Retained for 3 years for customer service and dispute resolution
• Log Data: Retained for 12 months for security and performance monitoring
• Marketing preferences and opt-outs: kept for as long as we need them to respect your choice. If you ask us to delete your data, we keep only what we need to make sure we don't contact you again

Upon account termination, we will retain your data for 30 days to allow for reactivation, after which it will be securely deleted or anonymized, except where longer retention is required by law.

12. Your Data Protection Rights

Under applicable U.S. privacy laws and applicable data protection laws, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: You have the right to request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing: You have the right to request that we limit the processing of your personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the relevant U.S. state or federal data protection or consumer-protection authority.

To exercise any of these rights, please contact us at privacy@yallacrm.ai. We will respond to your request within 30 days. We may request verification of your identity before processing your request.

13. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform. These include:

• Essential Cookies: Required for the operation of our Services (authentication, security, load balancing)
• Functional Cookies: Enable personalization and remember your preferences
• Analytics cookies: our own analytics script (served from reporting.yallacrm.ai) sets a cookie named yalla_uid, kept for up to two years, and stores the campaign details (utm_ parameters) and ad click identifiers (such as fbclid, gclid, ttclid and yclid) from the link you arrived through, so we can see which campaigns bring visitors and enquiries. It also records the pages you visit, including their full address. These are not currently controlled by the cookie banner: we rely on our legitimate interest in measuring our own website and marketing. You can object by emailing privacy@yallacrm.ai, or delete the cookies in your browser settings.
• Marketing cookies: the Meta Pixel and the TikTok Pixel, which help us measure and improve our advertising. They load only if you click Accept in our cookie banner. If you accept, events such as a form submission are also sent to Meta from our server (Meta Conversions API); if you don't, they are not. The one exception is a purchase made on this website: we tell Meta about completed purchases from our server whatever your cookie choice, to measure our advertising.

Referral cookie: if you arrive through a Yalla partner's link (yallacrm.ai/p/...) and accept cookies, we store that partner's referral code in a first-party cookie named yalla_ref for 90 days, on yallacrm.ai and its subdomains. If you don't accept, we don't set this cookie: the code stays in the page address and in memory until you reload or leave the page. Either way, we add the code to the link when you go on to sign up or book a demo, and, if the cookie is set, to any enquiry form you send us, so we can credit the partner who referred you. Our analytics (above) also record the page address, which includes the code. If you become a customer, we tell that partner that you signed up and pay them a commission based on what you pay us. The cookie holds only the partner's code.

When you first visit, a banner asks whether you accept these non-essential cookies: the marketing cookies and the referral cookie described here. Strictly necessary cookies, including the one that remembers your choice for 180 days, are always set. You can change your choice at any time with the Cookie settings link at the bottom of every page, and you can delete cookies in your browser settings.

14. Third-Party Links and Services

Our Services may contain links to third-party websites, applications, or services that are not operated by us, including WhatsApp, Facebook, and Instagram. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our platform.

15. Children's Privacy

Our Services are intended for business use and are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately at privacy@yallacrm.ai, and we will take steps to delete such information.

16. Marketing Communications

We may send you marketing communications about our products, services, and promotions. We send these to business contacts on the basis of our legitimate interests, and ask for your consent first where the law requires it, for example before emailing sole traders and individuals in the UK. You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in our emails
• Updating your preferences in your account settings, if you have a Yalla CRM account
• Contacting us at privacy@yallacrm.ai

Please note that even if you opt out of marketing communications, we may still send you service-related messages necessary for the administration of your account.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email or through a notice on our platform
• Obtain your consent where required by law

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes constitutes acceptance of the updated Privacy Policy.

18. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Wyoming and applicable United States federal law, without regard to conflict-of-laws principles. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the state and federal courts located in the State of Wyoming, United States.

19. Google User Data and Limited Use

When you connect a Gmail or Google Workspace mailbox to Yalla CRM, we access data from your Google Account through Google APIs. This section explains exactly what we access, why, and the limits we place on ourselves. It applies in addition to the rest of this Privacy Policy.

What we access

Only after you grant permission on Google's consent screen, and only the following:

• Email messages and their metadata (sender, recipient, subject, date, labels and attachments) from the mailbox you connect.
• Your Google Account email address and basic profile information, used to identify the connected mailbox.
• Permission to send email on your behalf from that mailbox, and to change message state such as read, unread and archived, when you take those actions inside Yalla CRM.

How we use it

Google user data is used solely to provide features you have asked for:

• Displaying your mail inside the Yalla CRM inbox and linking messages to the corresponding contact record.
• Sending replies and campaign email that you compose and initiate.
• Keeping message state in step between Yalla CRM and Gmail.

AI features and Google user data

Yalla CRM includes AI features. When you ask the assistant about your inbox — to summarise a thread or draft a reply, for example — the content of the relevant messages, which may include email from a connected Google mailbox, is sent to our AI model providers (currently Anthropic and OpenRouter) solely to generate that response. It is processed only to answer your request, is not retained by those providers to train their models, and is never used to develop or improve generalised artificial intelligence or machine learning models. This happens only when you invoke an AI feature on that conversation.

How we store and protect it

OAuth tokens are encrypted at rest using AES-256-GCM and are never exposed to your browser or to other customers. Message data is stored within your account only, isolated from every other account, and is transmitted over TLS.

What we never do

We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalised artificial intelligence or machine learning models.

We do not transfer Google user data to third parties except as necessary to provide and secure the features described above, to comply with applicable law, or where you have given explicit consent.

Withdrawing access and deleting your data

You can disconnect a mailbox at any time in Yalla CRM under Integrations then Email, which revokes our access and deletes the stored tokens. You may also revoke access directly from your Google Account permissions page at myaccount.google.com/permissions. To request deletion of message data already synced, contact privacy@yallacrm.ai.

20. UK and EU GDPR

This section applies if you are in the United Kingdom or the European Economic Area (EEA), where the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”) or the EU General Data Protection Regulation (“EU GDPR”) apply to our processing of your personal data. It adds to the rest of this Privacy Policy. Where the two differ, this section is what applies to you.

20.1 Who is responsible for your data

The controller of your personal data is Yalla Technologies LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. You can reach us about anything in this policy at privacy@yallacrm.ai.

• We are the controller for personal data about visitors to our website, people who contact us, book a demo, sign up for or buy our Services (account, billing and support data), people who apply to our partner program, and people at businesses we contact about Yalla (prospect data).
• We are a processor for the personal data our customers store and process in Yalla CRM, such as their own contacts, leads and conversations. For that data our customer is the controller and we process it only on their instructions, under our Data Processing Agreement, which is available on request. If you are one of our customers' contacts, please send requests about your data to the business that holds it. If you contact us instead, we will pass your request to them.

20.2 Our lawful bases

We only process your personal data where the law gives us a basis to do so:

• Contract: to provide the Services you have signed up for, manage your account and billing, and take steps you ask for before entering a contract, such as setting up a demo or a trial.
• Legitimate interests: to run, secure and improve our website and Services, answer enquiries, understand how our website is used, credit partners for the clients they refer, and promote Yalla to businesses. This includes contacting people at businesses about Yalla using business contact details we obtain from public sources, such as company websites, business directories and company registers, or from business contact data providers, where the message is relevant to their role. Where the law requires consent before sending marketing email, for example to sole traders and individuals in the UK, we ask for it first. Every such message gives you an easy way to opt out, and when you do we record it so that we don't contact you again. We weigh these interests against your rights and do not rely on them where your interests override ours.
• Consent: where we ask for it: for the marketing and referral cookies described in section 13, which we use only if you click Accept in our cookie banner, and for certain marketing messages. You can withdraw consent at any time, which does not affect processing that took place before you withdrew it.
• Legal obligation: where we must process data to comply with the law, for example keeping tax and accounting records or responding to lawful requests from authorities.

If you don't give us the information we need to provide the Services, such as a working email address, we may not be able to open or run your account. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

20.3 Your rights

Under the UK GDPR and EU GDPR you have the right to:

• Access the personal data we hold about you and get a copy of it.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted where there is no good reason for us to keep it.
• Restriction: ask us to limit how we use your data, for example while we check its accuracy.
• Portability: receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation, where we process it by automated means on the basis of consent or contract.
• Object to processing based on our legitimate interests. You can object to direct marketing at any time, for any reason, and we will stop.
• Withdraw consent at any time, where we rely on consent.
• Complain to a data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EEA you can complain to the supervisory authority in the country where you live or work, or where you think the problem happened. We would appreciate the chance to deal with your concern first, so please contact us.
• Nothing in section 18 or elsewhere in this policy limits your right to complain to the data protection authority, or to bring proceedings in the courts, of the country where you live.

To exercise any of these rights, email privacy@yallacrm.ai. We may ask you to confirm your identity. We respond within one month, which the law allows us to extend by up to two further months for complex or numerous requests; if we do, we will tell you why. Exercising your rights is normally free.

20.4 International transfers

Yalla Technologies LLC is based in the United States, and we and our service providers store and process personal data outside the UK and the EEA. As of the date of this policy:

• Yalla CRM's application servers run in Singapore, and its main database is hosted in India.
• Files stored in Yalla CRM, such as attachments and media, are held with Cloudflare, which may store them in the United States and other countries.
• This website is hosted in the United States, and our website analytics in Singapore.
• Systems we use to research businesses and run our own outreach are hosted in Germany and Singapore.
• Other service providers, such as payment, email, analytics and AI providers, may process data in the United States and other countries.

Where we transfer personal data from the UK or the EEA to a country that does not have an adequacy decision or regulations, we rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement or the UK Addendum to those clauses, as appropriate. You can ask us for more information about these safeguards at privacy@yallacrm.ai.

20.5 How long we keep your data

We keep personal data only as long as we need it for the purposes above:

• Account, communication and log data: as set out in section 11.
• Billing and transaction records: as long as tax and accounting law requires.
• Prospect data: while it is relevant to our outreach, then deleted. If you opt out, we keep only what we need, such as your email address, to make sure we don't contact you again.
• Partner program data: for as long as you are a partner and afterwards as long as we need it to settle commission and meet legal requirements.
• Data we process for customers as a processor: as our customer instructs, and deleted or returned at the end of the service as set out in our Data Processing Agreement.

20.6 How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption in transit, encryption of stored access tokens, access controls that keep each customer's data separate from every other customer's, and limiting staff access to those who need it. If a personal data breach is likely to put your rights at risk, we will notify the relevant data protection authority and, where the law requires, you.

20.7 UK and EU representative

Yalla Technologies LLC is established in the United States. If we are required to appoint a representative in the UK or the EU under Article 27 of the UK GDPR or EU GDPR, we will name them here with their contact details. You can always contact us directly at privacy@yallacrm.ai.

21. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all legitimate requests within 30 days. If your request is particularly complex, we may require additional time, in which case we will notify you accordingly.